Questions tagged [c++]

C++ is a statically typed, free-form, multi-paradigm, compiled, general-purpose programming language. It is considered an intermediate level language.

Filter by
Sorted by
Tagged with
1 vote
0 answers
157 views

problem with hooking __usercall function and asm code

I need a hook function with the __usercall convention. I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
user42122's user avatar
3 votes
1 answer
1k views

How do I reverse an exe packed with an unknown packer?

I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
beytrod's user avatar
  • 33
1 vote
1 answer
698 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
markzzz's user avatar
  • 87
4 votes
0 answers
2k views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
Benoit POTIER's user avatar
1 vote
1 answer
101 views

Turning very complicated arithmetic and reverse engineered check into useable code in C#

so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
Oliver Vedel Rasmussen's user avatar
1 vote
0 answers
59 views

Is there any available source code which is Windows 64 bit compatible that can disassemble binary code?

I'm writing a program that takes as input a single byte of binary (machine code from code segment) and converts it into assembly. I've done some searching online but have yet to find anything helpful. ...
vSm's user avatar
  • 11
1 vote
0 answers
417 views

How can I hook structure members in frida

I have a code like this: class CURLNetRequest : public CNetRequestBase { DEFINE_LOGCLASS; struct ProxySettings { void initFromConfig(); String host; ...
hanan's user avatar
  • 309
1 vote
0 answers
98 views

Problem to hook a parameter with _thiscall function

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function: .text:00488DA0 ; =============== S U B R O U T I N E ==========================...
user3449922's user avatar
0 votes
1 answer
283 views

How to speed up finding a function from pseudocode in IDA?

I have a function with the pseudocode of __int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3) { if ( qword_7FF709F91498 ) return (*(__int64 (__fastcall **)(ID2D1Geometry *...
CoolNite's user avatar
4 votes
2 answers
582 views

How to reverse a game and inject a dll in client program?

I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
Lftbrito's user avatar
1 vote
0 answers
152 views

How to debug C++ module/function call used in .net application?

I'm currently debugging a .net application by using dnSpy. There is a function where I have call like this <Module>.X.Y.Z.Initialize(ptr, ptr2, flag); The function belongs to a DLL and ...
programmerskitchen's user avatar
1 vote
0 answers
108 views

SetPixel seem not work on some external window

I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window. To do a test I have created this code: Here my hooked function: My_hooked_function(int a3)...
user3449922's user avatar
1 vote
0 answers
103 views

Capstone Disassembler to Extract OpCode from Malware and Benign Executables in C++

The project that I am trying to develop has as a vital component, specifically a machine learning based malware detection system. The way in which I decided to teach the detection system in order to ...
odyssey's user avatar
  • 31
1 vote
0 answers
702 views

Getting helpful information on classes in Ghidra?

I'm an intern at an engineering firm that's being contracted to decompile some ELF32 files on an ARM device compiled with GCC. Currently, we're using Ghidra, but no one at the firm (including me) ...
Josh Tint's user avatar
1 vote
0 answers
102 views

What change to the source code would produce an LT compare rather than an OLT compare in MIPS assembly?

I need some help reverse engineering a function in MIPS assembly. It was compiled for the PlayStation 2's EmotionEngine CPU. My goal is to produce a matching decomp of the function; it is the proof-of-...
Zac's user avatar
  • 11
1 vote
1 answer
265 views

How can I override a x86 instruction in c++?

I am trying to replace a jmp instruction with a ret in c++. How can I do that?
Mlemix's user avatar
  • 21
1 vote
0 answers
104 views

Disassemble Executable Automatically in C++

I have 2 types of files, namely benign and malware. I would like to build a malware detection system based on the assembly language used by these files, by using machine learning. The language that I ...
odyssey's user avatar
  • 31
-1 votes
1 answer
807 views

How to call and what means: _DWORD *__thiscall

I have one question maybe you can help, I always find this functions in IDA: void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4) And I use them like this: // talkChannel typedef DWORD(...
kuhi's user avatar
  • 161
1 vote
1 answer
252 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
kuhi's user avatar
  • 161
0 votes
0 answers
177 views

Can't get Visual C++ to generate the same code give by Ghidra

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following: ...
user3900456's user avatar
1 vote
1 answer
626 views

Strange DWORD/QWORD C++ Strings in decompilation

I have never seen something like this before but I assume this is some kind of way C++ allocates dynamic strings. In my decompilation listing in Ghidra I see something like: local_14 = DAT_00404004 ^...
John S.'s user avatar
  • 23
1 vote
2 answers
451 views

Relationship between compiled bytes of jmp instruction and target memory address

I'm very new to all this, so sorry if I mess up and/or am unclear. I'm working on reverse engineering assault cube, where a lot of people start, and I'm struggling to understand how this one AOB ...
owaowabeep's user avatar
1 vote
2 answers
2k views

How to find specific function in IDA pro

Apologies if this account question may sound a bit stupid but I really need help with something Let's say I had a function that looks something like this : #undef curl_easy_setopt CURLcode ...
CoolNite's user avatar
2 votes
2 answers
517 views

C++, Windows UI Automation and DaVinci Resolve

I've been researching this topic for a while, but the information is extremely limited and very confusing. DaVinci Resolve is an editing and color grading software, its tools are so many and so ...
Cinematic Galaxy Ita's user avatar
1 vote
1 answer
131 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
Ronny's user avatar
  • 73
1 vote
2 answers
2k views

Is it possible/feasible to decompile a program written in C++ to C?

I've not seen a lot of material on this. I've seen people attempting to bring a C++ program back to C++ code, and claiming how hard it is, but C code from C++ program? I don't know. If it is possible, ...
Luke Dunn's user avatar
1 vote
1 answer
209 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
Ray's user avatar
  • 1,083
0 votes
1 answer
108 views

Understanding the meaning of EBP + 0xffff98b4

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I ...
MansenC's user avatar
0 votes
1 answer
87 views

Constructors testing for strange in-stack value

This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before ...
mindoverflow's user avatar
2 votes
1 answer
385 views

How do I reverse engineer structs that are put as parameters in a function

how do I go around figuring out where to reverse engineer a struct? As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
Oliver Vedel Rasmussen's user avatar
2 votes
2 answers
547 views

How to restore struct fields

I have an object named ComputeService::RPC that is being used as input in a function inside a binary file: __int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this) pc *...
E235's user avatar
  • 583
1 vote
1 answer
121 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
Mlemix's user avatar
  • 21
0 votes
1 answer
62 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
mindoverflow's user avatar
0 votes
1 answer
2k views

How do I get all sections in a PE file using C++?

So I am wondering how can I get all sections and their info from a dumped PE file on the disk, using C++. I have the entire PE loaded on a buffer, the NT headers, and hopefully the DOS headers. I need ...
rafa_br34's user avatar
2 votes
1 answer
504 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
Irbis77's user avatar
  • 326
1 vote
0 answers
55 views

Scraping data from an audio analyzer application

Briefly: I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start? ...
gabrielsalvador's user avatar
1 vote
0 answers
41 views

Make avaible x64 C++ exceptions on manually mapped module

I am trying to bind Lua on manually mapped module. As you can see clearly on here. They are using C++ or C exceptions on their API and there is no way to avoid them. I wonder to know if there are ...
aya's user avatar
  • 11
1 vote
1 answer
194 views

IntelPin, Ins_Insertcall?

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall: VOID CpuidCalled(const CONTEXT* ctxt) { std::cerr << "+++++&...
ALex's user avatar
  • 21
1 vote
1 answer
758 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
Iter Ator's user avatar
  • 214
0 votes
1 answer
539 views

IDA interpretation of switch-case statement

This is my first question on this forum, so I hope that it would not be offensive or redundant. So recently I am attempting to developing some kernel extensions for Apple's macOS using the IOKit ...
vv001's user avatar
  • 3
3 votes
3 answers
985 views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
Ballers's user avatar
  • 49
1 vote
1 answer
450 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
yfr24493AzzrggAcom's user avatar
0 votes
1 answer
301 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
Irbis77's user avatar
  • 326
3 votes
1 answer
458 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
vtable's user avatar
  • 183
1 vote
1 answer
442 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
Naxin's user avatar
  • 180
0 votes
0 answers
705 views

IDA does not load PDB file

I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol ...
black4's user avatar
  • 333
2 votes
0 answers
601 views

Passing a String into a Function With GDB

So, I have a function with the prototype according to GDB: {std::string (std::string)} 0x56027729e545 <function(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator&...
0x96's user avatar
  • 21
0 votes
0 answers
216 views

The way to determine how the decompiled constructor is structured

I have the following constructor decompiled by Ghidra, i.e. Game. I know some of the functions, which are part of that constructor. And thus I have created my interpretation of that structure. But I ...
Irbis77's user avatar
  • 326
1 vote
0 answers
81 views

What is the correct argument for the disassembled function / constructor?

I have the following code disassembled by Ghidra. It first initialises the local variable of the particular type (local_68) and then passes it to the constructor. The variable seems to be initialised ...
Irbis77's user avatar
  • 326
2 votes
1 answer
94 views

libuv - spoofing user-agent problem

Im trying to give an app "second life" (gamedev "banned" User-Agent of this tool to avoid requests from it). This app is using websocket to get real-time result and then use this ...
CospriMalice's user avatar

1
2
3 4 5
9